The vulnerability exists in the Document Embedder – let visitors read files without downloading plugin for WordPress and is a stored, DOM‑based cross‑site scripting flaw. It is caused by inadequate sanitization and escaping of the block JSON attribute documentSource.doc that is stored in post_content. An authenticated contributor or higher can inject malicious JavaScript payloads that are executed when a visitor clicks the embedded document’s Download button, which triggers an AJAX path that creates a malicious anchor and programmatically clicks it.

All WordPress installations that use the Document Embedder – let visitors read files without downloading plugin with a version of 2.4.0 or older are vulnerable. The plugin is provided by bplugins.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to possess contributor‑level permissions or higher within the WordPress site to insert the malicious block, and a victim must actively click the Download button for the payload to execute. The combination of privilege requirement and user interaction mitigates the overall risk compared to a purely remote code execution flaw, yet the impact on confidentiality, integrity, and availability of the affected site remains significant.